WinEventLog:Security filtering does not work

[arapozo]

Even after reading the documentation and a lot of posts here on answers, I just can't get filtering to work. I've recently installed two VM to test it out.

One indexer server and one universal forwarder. The configuration is being done in the Indexer since universal forwarder according to the docs doesn't do parsing.

REGEX is set to "." to test if the filtering is working.

SPLUNK\etc\system\local\props.conf
[WinEventLog:Security]
TRANSFORMS-setnull = setnull

SPLUNK\etc\system\local\transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

Isn't this configuration supposed to filter everything from WinEventLog:Security?
I get all the logs anyways.

Additional information that may be related:

http://answers.splunk.com/questions/13196/universal-forwarder-sending-cooked-data-to-indexer

[Ellen · Accepted solution]

You have run into a known issue (SPL-38443) with the 4.2 Lightweight and Universal Forwarder.

The Windows 4.2 lightweight and universal forwarder parses WinEventLog datastreams on the forwarder, preventing all parsing control on the indexer.

The symptoms of this are: no filtering nor routing to the nullqueue based on props and transforms. WinEventLog data is bypassing props.conf and transforms.conf on the indexer.

The workaround would be to use a 4.2 full/regular forwarder or 4.1.x lightweight forwarder but this will be fixed for 4.2.1

http://www.splunk.com/base/Documentation/latest/ReleaseNotes/Knownissues

[MuS]

Hi Ellen,
is this really solved in 4.2.1 universal forwarder? I just ran into exactly this problem, that I was unable to redirect WinEventLog events no matter what transform I used. Only way to get them into different indexes was to set the index in inputs.conf on the 4.2.1 universal forwarder.

best regards, MuS

[the_wolverine]

http://answers.splunk.com/questions/3239/try-to-route-certain-wmi-events-to-nullqueue

[arapozo]

I just installed the forwarder and only selected the security log in the wizard, nothing else.

[jbsplunk]

What does the input on the Universal Forwarder use to get data from the event logs?

[arapozo]

I'm not using WMI to collect events, the source is always a universal forwarder.